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Abstract 

Secure quantum key distribution can be achieved with an imperfect single-photon source through 
implementing the decoy-state method. However, security of all those theoretical results of decoy- 
state method based on the original framework raised by Hwang needs monitoring the source state 
very carefully, because the elementary proposition that the counting rates of the same state from 
different sources are equal does not hold in general when the source is unstable. Source intensity 
monitoring greatly decreases the system efficiency. Here without using Hwang's proposition for 
stable source, we present a sufficient condition for a secure decoy-state protocol without monitoring 
the source intensity. The passive 2-intensity protocol proposed by Adachi, Yamamoto, Koashi, and 
Imoto(AYKI) (Phys. Rev. Lett. 99, 180503 (2007) ) satisfies the condition. Therefore, the protocol 
can always work securely without monitoring the source state or switching the source intensity. 
We also show that our result can greatly improve the key rate of the 3-intensity protocol with a 
fluctuating coherent-state source. 
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I. INTRODUCTION 



Imperfect single-photon source is used in most of the existing set-ups of quantum key 
distribution (QKD)[l|-|3|. To make it secure even under photon-number-sphtting attack 
4, 5|, one can use the decoy-state method jz iSl based on the general theory of QKD with 
an imperfect source which was first built by Inamori, Liitkenhaus and Mayers and then 
father studied with some improved results[6]. There are also some other methods [l^ 
which can make secure QKD with an imperfect source. 

Though many experiments on the decoy-state QKD have been done 
decoy-state theoryjs-lOl assumes perfect control of the source states in the photon number 
space. This is an impossible task for any real set-up in practic. A new non-trivial problem 
arises in practice is how to carry out the decoy-state method securely and efficiently with 
an unstable source. 



16j, the original 



The most important proposition of the decoy-state method given by Hwang 

Sk 



i is 



(1) 

where Sk and s'f. are the yield (counting rate) of those fc— photon pulses from the decoy source 
and that from the signal source. However, as pointed out in Ref. 0, H, 2^ with concrete 
examples that this elementary proposition does not always hold for a fluctuating source. 
(Note that the fluctuation of each individual pulses are in general not independent.) 



To solve this problem, a number of theoretical works have been done|17l-l22l|. In particular, 
without using Eq.([T]), a general formula was given in Ref.{l9| for the 3-intensity decoy-state 
method with whatever type of error pattern in the source, if we can monitor the range of a 
few parameters of each individual pulse state out of Alice's lab. Although source monitoring 
can be done with the existing technology by detecting the intensity of a strong father pulse 



in the beginning 



23 



24| . it will raise the cost of the real QKD system and decrease the 



outcome efficiency because the repetition rate of strong pulse detection is low. Therefore, it 
is a meaningful job to find a class of decoy-state protocols which can work securely without 
monitoring any source fluctuation . 

Here, without using Eq.([T]), we shall give the condition that a decoy state protocol can 
work securely with a fluctuating source. We then show that the 2-intensity passive protocol 
proposed by Adachi, Yamamoto, Koashi, and Imoto (AYKI) jl2| meets the condition of our 
theorem. 
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In what follows, we shall first derive an improved formula for a 2-intensity decoy-state 
protocol with source fluctuation. Based on this, we propose a theorem on the condition for a 
protocol to work securely without source monitoring. Directly applying the theorem we find 
AYKI protocol meets the condition and the main formula in AYKI protocol is independent 
of whatever source intensity fluctuation. We then extend our formula to the 3-intensity 
protocol and show its high efficiency for a coherent-state based protocol with numerical 
simulation. 

II. OUR THEOREM AYKI PROTOCOL 

In a 2-intensity protocol, Alice has 2 (virtual) sources, the decoy source Y which prepares 
decoy pulses, and the signal source Y' which prepares signal pulses. At any time z, each 
source prepares a pulse and Alice randomly choose one of them sending out to Bob. Suppose 
at any time i Alice has a probability pj, p[ to sends out the pulse from source Y and Y' , 
respectively {pi +p[ = 1). Note that pi, p[ are not necessarily constant values here. Denote 
Pi, p\ as state of a decoy pulse and that of a signal pulse produced at the ith time: 



Here J can be either finite or infinite. 

Definitely, it makes no difference if all pulses sent out to Bob are actually produced by 
only one physical source. But we assume there are two sources for clarity in presentation. 

In the whole protocol, Alice sends Bob M pulses, one by one. In response to Alice, Bob 
observes his detector for M times. As Bob's zth observed result, Bob's detector can either 
click or not click. If the detector clicks in Bob's ^th observation, then we say that "the zth 
pulse from Alice has caused a count". We disregard how the ^th pulse may change after it 
is sent out. When we say that Alice's ith pulse has caused a count we actually mean that 
pulse is accompanied by a click at Bob's side at Bob's ^th observation. 

Given the source state in Eqs.([2]), any ith pulse sent out by Alice must be in a specific 
photon-number state. To anyone outside Alice's lab, it looks as if that Alice only sends a 
photon number state at each time i: sometimes it's vacuum, sometimes it's a single-photon 
pulse, sometimes it is a 2— photon pulses, and so on. We shall make use of this fact that any 
individual pulse is in one Fock state. On the other hand, pulses sent out to Bob can also be 



J 



J 




(2) 
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classified by which source it comes from, i.e., a decoy pulse if it is from the decoy source or 
a signal pulse if it is from the signal source. 

Given Eqs.(|2]), we have the following formulas for Vdi\k and Vsi\k , the probabilities that 
the ith pulse comes from the decoy source or signal source; if the ^th pulse contains k photons: 

'Pdi\k = PiO-kidki, 'Psi\k = pWkidki (3) 

where 

dk^ = for A; > 0. (4) 

Pittki + Pitt'^i 

Based on these, we can build up equations which lead to lower bound of the number of 
single-photon counts. 

A. Definitions 

We postulate some definitions first: Set = {i = 1,2, ■ ■ -M}, it contains all i. Set C 
contains any pulse that has caused a count; set Ck contains any /c— photon pulse that has 
caused a count. Mathematically, the sufficient and necessary condition for z G C is that the 
ith pulse has caused a count. The sufficient and necessary condition for i G is that the 
ith pulse contains k photons and it has caused a count. For instance, if the photon number 
states of the first 10 pulses from Alice are |0), |0), |1), |2), |0), |1), |3), |2), |1), |0), and 
the pulses of i = 2, 3, 5, 6, 9, 10 each has caused a count at Bob's side, then we have 

C = {i\i = 2, 3, 5, 6, 9, 10, ■ ■ ■}; Cq = {i\i = 2, 5, 10, ■ ■ ■}; Ci = {i\i = 3, 6, 9, ■ ■ ■}. (5) 

The number of counts caused by A;— photon pulse Uk is just the number of elements in set 
Ck- We shall use notation Ukd, nks for the the number of counts caused by a A;— photon decoy 
pulse and a A;— photon signal pulse, respectively. These numbers cannot be directly observed 
in the experiment. Obviously, Ukd + ^ks = rik- Suppose in the whole protocol, there are 
counts caused by decoy pulses and counts caused by signal pulses. Note that and A^^ 
can be directly observed in the protocol therefore we regard them as known values. Our goal 
is to find a formula for nis, i.e., to formulate nis by nos, n^d and the known values Nd-, Ng 
and the bound values of the parameters in the decoy state and signal state of Eq.(l2]). (In 
a 2-intensity protocol, values of n^d or riQ^ is unknown, but one can still calculate the final 



key rate with worst-case estimation 
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12|-) 



B. Derivation of Main formulas 



With definitions postulated earlier, we have 



Nd = ^ rikd, Ns = ^ Uks (6) 



Asymptotically, 



Consequently, 



A;=0 fc=0 



nkd = ^"Pdiifc; n^s = ^"PsiiA; (7) 



PiO'kidki, (8) 

«Gci k=2 iGCfe 



J 

Ns = nos + Y^ pWiidii + ^Y1 P'^^'k^dli■ (9) 

ieci k=2 i£c^ 

We want to find the lower bound of value nig. Recall the definition of dki in Eq.(|4]), we 
have 



ni 

— ' ^ — ' i -|- niaj< 
PiU-uaii ^ rild -h riis - i\is = maxi 

Eqs.dHl E]) can be written in 



riid = y^Piaiidii < nid + nu - Nu = max{-!^)Nis (10) 



AT, = no, + max(^)iVi, + A - 6 (11) 
Ns = rios + Nu +A' + ^i (12) 

where 

J J 
A = ^ ^Piafci4i; A' = ^^pWkidkh (13) 

fc=2 iecfc k=2 i&Ck 

and 

6 = nu - iVi, > (14) 
Using the expression of A', we will have: 



A' = V V ^ > W ^ = A 

PiOfci + P'A, " 1 + max,e,,(^) 



(15) 
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Further, we assume the important condition 

niax(^) < max(^) < max(^), for all k>2. (16) 
i6c, p'.a'^. j€c2 p'.a'^. jeci p'.a\- 

So we can write A' = A + ,^2 and .^2 > 0. We also have: 

J 



k=2 ieck ^* 

^ 1 



1 + max,gc, (^f^) 
J max,ec.(^f^) 
l + max,ee.(^) 

= max(^)A-6-e3 (17) 

where 6 = EL2 E.ec, .^^^ > 0, according to Eq.dH. 

With Eq.([T7]), Eq.([l2]) is equivalent to ' 

N, = + max(^)iVi, + max(^)A - - 6 - ^3 

Ns = nos + iVi, + A + ^1 + 6 (18) 

Given the Eqs.ffTT] [T8|l . we can formulate iVi^: 

- max,e,,(^)Ar, + max,e,,(^)no. - + max,e,,(^)(ei + 6) + + 6 + 6 

maxj ( ) - maxj ( 7^ ) 

(19) 

Since ^1,^2, and ^3 are all non-negative, and maXjgci(^T^) — maxjgc2(^T^) > by Eq.( !T6|l . 
we now have 

Nd - maxjec2(^ff^)^s + maXjgc2(^f^)%s - %d 



maxjgcilp;^j — maXjgcal^/^J 



Therefore, we can now bound the fraction of single counts among all counts caused by the 
signal source 

Nu ^rf-"^aXje^2(^fgi)iV^ + maXjgc2(^f^)^Os-nod 
^''-^s- iV.(max,Lr(g§^)-max,,,j|g^)) 

iVrf - maXj(^fgi)A^s + maXj(^f^)nos - n^d 
- ^.(niax.(^)-max,(%)) ^'^^ 
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The last inequality is due to the fact that if we replace max^gcj. by maxj^c = niaxj in all 
the previous derivation including Eg. (1161) . all the intermediate inequalities still hold. For 
the decoy source, we can bound the fraction of single-photon counts by: 



Ai > min(^^)A; (22) 



where miuj = minjgc". In calculating the final key rate, we also need the relation between 
quantum bit error rate (QBER) for single-photon counts due to the decoy source cid and 
due to the signal source Ci^. Suppose z G Ci and quantum bit flip probability is Cu. Then 
the total errors for single photon counts from each sources are: 



ei, = -^"'^^ P-'^H+P.^n (23) 
riid 



E 



eu = ^'"^'^^-"H (24) 

nis 



p'a' ^ piau-!^ 



Since nu = E.gc, ^J^^H^fe = E^ec, p^a^^^X ^ ^e get: 



- \,o,r,. nxd (25) 



And there is: 



So: 



max,, 



PjOxjX 



max,- , , 



ei. < — yl^ei, (27) 



mm^f^T^ 



In the same reason, we can also give a lower bound of eis. Finally we obtain 



mmi(^^-r-l max 



^^p'^a\ 

max,- mm,- i:^-r^ 



eid < eis < — — Tjua^eid (28) 



^and^^ 

Eq. fl2T]) is identical to Eq.(18) of Ref. 19|, which is the formula of fraction of single-photon 



If ^T-T^ and are constant numbers for all j G C, then cis = Cid and the last inequality in 



counts with a stable source. We conclude the following theorem: 

Theorem: Decoy-state QKD with a fluctuating source can be used as if the source were 
stable if and are constant numbers for all ?' G C . 

p . a , p a L ■ •> 
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Interestingly, the condition in the theorem is not equivalent to Eq.([T]), the elementary 
proposition given by HwangQ]. Our theorem only depends on the fluctuation characteri- 
zation of those pulses in set C, i.e., those pulses accompanied by a click of Bob's detector, 
while Eq.([T]) actually requests nj^ct/Nkd = riia/Ni^ therefore needs the fluctuation character- 
ization of all pulses from Alice's lab. Here A^^^ and N^g are number of k-photon pulses from 
decoy source and that from signal source, respectively. Given this fact, one can in principle 
construct speciflc cases where Eq.([T]) does not hold while the condition in our theorem still 
holds. This shows that our Eq.(|3]) is indeed more fundamental and more general than Eq.([T]). 



C. Conclusion on AYKI protocol 

The AYKI protocol uses a heralded source of: 

oo 

|^.)as = $^V^I^)a|A;)5 (29) 

k=0 

where Xki = + The heralded source state can be produced by, e.g., the 

parametric down conversion (PDC) which is pumped by strong light pulses whose intensity 
fluctuation can be as large as 20%. In the protocol, Alice detects mode A and sends out 
mode S to Bob. Mode S" is a decoy pulse when Ahce's detector clicks and a signal pulse 
when her detectors does not click. Suppose Alice's detector has a detecting efficiency rjA 
and dark count rate (Ia- At any time i, given the two mode state in Eq. fl29l) . the probability 
that her detector clicks or not is 

, dA + HiVA 

Pi = ^ 

1 + fliT]A 

Pi = — (30) 

1 + fJ'i'nA 

When the detector clicks or not, we obtain a signal state or a decoy state at mode S in the 
form of Eq. ([2]) , and 

l + f^iVAy . 

aki = —. 1 — Xki[l-'yk) 

i — Ca 

= -1 — : Xki7k (31) 

d-A + fJ-iVA 

and 

7fc = !-(!- ci^)(l-r/A)' (32) 
8 



We find 

V'A. In l-{l-dA){l-VAY ^ ^ 

They are independent on i, hence source fiuctuation does not change the final formula of the 

protocol by our theorem. Also, according to Eg. ( 1211) we can write: 



■72 



72 

1-71 _ 1-72 
71 72 



nu = > (34) 



Using the fact no^ = = we have 



a; > — , (35) 

1 — Ar r 1—71 1—72 ^ ^ ^ 



71 72 



which is just the major formula in Ref.|12|. We have not used Eq.([T]) in our proof, though 
the derivation given by AYKI[12J have assumed one constant intensity fi and used the 
assumption of Eq.([l]). Our proof concludes that the AYKI protocol actually works securely 
with whatever intensity fiuctuation, though the key rate can be low if the source fiuctuation 
is large, in which case one may observe poor values of Ng and Nd- 

III. IMPROVED FORMULA FOR 3-INTENSITY PROTOCOL 

If we add a vacuum source to the 2-intensity protocol and uses vacuum source with 
probability Pm at the zth time, we have a 3-intensity protocol where one can estimate number 
of vacuum counts nos, Uod niore precisely therefore improve the final key rate. Suppose the 



vacuum source caused A^o clicks. By similar derivation done in Ref. 



19| . we obtain 



nod < — max{pjaoj) y^Podoi < — max{pjaoj)No. (36) 



Po jeco ^ pq j 



A. Numerical simulation 

In our major formula. Eg. (121 p . there are terms of maxj, this economic worst-case esti- 
mation can be significantly smaller than the normal worst-case of estimation as 
proposed in Ref. 19|], hence Eq.( l2T1) can improve the key rate a lot. Consider the model 
that both decoy pulse and signal pulse are generated through attenuating a common father 
pulse at time i. We set p^ = Po, Pi = P and p[ = p' to be constants. The fiuctuation of 
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the final pulse out of Alice's lab consists of two parts: father pulse fluctuation and device 
(attenuator) parameter fluctuation. Suppose Alice wants to use intensity /x, ^i' for her decoy 
pulse and signal pulse. She wants to obtain them through attenuating the father pulse of 
intensity F by setting her attenuator's transmittance to be A^i = -p, Xg = ^ for a decoy 
pulse or for a signal pulse. However, the actual case is that at any time i, the intensity of 
the father pulse is Fj = F(l + 6i), Xm = Xd^I + eid) and Xsi = Xs{l + eis). We have the 
upper bounds of: \6i\ < 6, \eid\ < and |ejs| < e^. The actual intensity of the ith pulse out 
of Alice's lab is 



decoy: /i, = + Si){l + e 



signal : /i • 

paki X 



max 



id 



^I'{l + 6i){l + e^s) 

for k > 1 



(37) 
(38) 
(39) 
(40) 



In a real experiment, only one pulse is prepared and sent out at any ith time. Values fii and 
/X- can be interpreted as the would-be values if Alice decided to produce a decoy pulse or 
signal pulse at the ith time, given a certain set-up. The bound of vacuum count in Eq.( l36|l 
is now rind < Mog-mini(/xi) y pNo -ma.xi{ij,'.) ^ Notc that here we have taken the normal 

worst-case estimation only for the device fluctuation, while we have taken the economic 
worst-case estimation for the intensity fluctuation of the father pulse. Our result here also 
applies to a source state a little bit different from a coherent state: we just add very small 
new fluctuation terms to the parameters Oki, a'f^^ in the states. If these terms are negligibly 
small, there effects to the final key rate is also negligible. Though there are also other 



methods 



18 



20 



22| for decoy-state QKD with fluctuating source, they|l8l.l20l.l22| only apply 



to the father pulse fluctuation, but not apply to the device fluctuation, as clearly pointed 
out in 



20 



2l| . As shown already, our method does not assume zero device fluctuation since 



it directly applies to the fluctuation of the flnal pulse out of Alice's lab. 



We use the experimental data for 50km given by done by Peng et al 16|] QKD for 
numerical simulation. The results are shown in Fig.l, where we set 6^ = 6^ = e. We flnd 
that the fluctuation of the father pulse intensity changes the flnal key rate very slightly using 
Eq. lpT!) in this work in the calculation, while the device fluctuation still degrades the flnal 



key rate drastically. Our results here also apply to the Plug-and-Play protocol 



25| 
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Graph(a) Qraph (b) 




FIG. 1: Comparison of relative key rates to that of zero fluctuation, a: Relative key rates with 
father-pulse-intensity fluctuation at e = and 2%. Line 1 and 2 are calculated with Eq. ()21|) of this 
work and Eq.(58) of Ref. jl9|. respectively, b: Relative key rate with device fluctuation. 6(left): 



Result calculated with Eq.(58) of Ref. 
b are for 6 = 1%, 6%, respectively. 



6(right) Result calculated with Eq.[2T]. Line 1 and 2 in 



IV. CONCLUDING REMARK AND DISCUSSIONS 

In summary, we have presented a criteria for the secure decoy-state protocol with source 
fluctuation. The AYKI protocol satisfies the criteria. A well known advantage of AYKI 
protocol is that there is no need to make intensity switching. Given our proof here, AYKI 
protocol neither needs intensity switching nor needs source intensity monitoring. As the 
base of the conclusion, our general formulas here are efficient for other protocols, such as 
the 3-intensity protocol using coherent states. It should be interesting to include the finite 



size effects 
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26l ] in the future study. 
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